IN THE CLAIMS 



Please Amend the Claims as Follows: 

1. (currently amended) A method of classifying a message, comprising including : 

determining the domain from which the message is purported to be sent; 

determining an IP address from which the message was relayed at some point in 
[[its]] transmission of the message: 

associating the domain with the IP address to create an IP address and domain 
pair; [[and]] 

classifying the message based on the using the IP address and domain pair based 
on one or more classification variables: and 

assigning a score to the IP address and domain pair, the score comprising a ratio 
of a first classification variable to a second classification variable, the one or more 
classification variables decaying with time. associated domain and IP addreoo [[.]] 

2. (currently amended) The method of claim 1, further comprising including overriding 
a white list based on the classification. 

3. (currently amended) The method of claim 1, wherein classifying includes 
determining that the IP address is not commonly associated with tho domain comparing 
the IP address and domain pair with a related IP address and domain pair . 

4. (currently amended) The method of claim 1, wherein classifying includes checking 
classifications of other messages associated with the [[same]] domain and different IP 
addresses. 

5. (original) The method of claim 1, wherein a plurality of IP addresses is associated 
with the domain. 
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6. (original) The method of claim \, wherein the IP address is associated with a plurality 
of domains. 

7. (original) The method of claim 1, wherein the IP address is a boundary IP address. 

8. (original) The method of claim 1, wherein the IP address is preconfigured. 

9. (original) The method of claim 1, wherein the IP address is preconfigured to be one 
hop from a gateway IP address. 

10. (original) The method of claim 1, wherein the IP address is learned. 

11. (original) The method of claim 1, wherein the IP address is adaptively determined. 

12. (cancelled). 

13. (currently amended) The method of claim 1, wherein the IP address is a boundary IP 
address determined according to claim 9 . 

14. (currently amended) The method of claim 1, wherein determining the domain from 
which the message is purported to be sent includes identifying the stated sender domain 
associated with the message domain io the stated condor domain . 

15. (currently amended) The method of claim 1, wherein the domain is [[the]] a 
boundary domain associated with a boundary IP address . 

16. (original) The method of claim 1, wherein classifying includes consulting a white 
list. 
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17. (original) The method of claim \, wherein classifying includes classifying the 
message based on previous classifications made to the IP address and domain pair. 

18. (cancelled) 

19. (original) The method of claim 1, wherein classifying includes determining a spam 
ratio. 

20. (original) The method of claim 1, wherein classifying includes determining a spam 
rate. 

21. (original) The method of claim 1, wherein classifying includes determining an 
estimated instantaneous spam rate. 

22. (cancelled) 

23. (original) The method of claim 1, wherein classifying includes giving a classification 
greater weight relative to another classification. 

24. (original) The method of claim 1, wherein classifying includes giving a user 
classification greater weight relative to a computer classification. 

25. (original) The method of claim 1, wherein classifying includes giving an 
indeterminate classification a fraction of the weight of a good classification. 

26. (original) The method of claim 1, wherein classifying includes consulting a table 
indexed by IP address and domain. 
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27. (original) The method of claim \, wherein classifying includes consulting a table 
indexed by IP address and domain wherein each cell includes information about 
previous classifications. 

28. (currently amended) The method of claim 1, further including comprising 
providing [[the]] a IP addrooo and domain classification based on the IP address and 
domain pair as input to another classifier. 

29. (currently amended) The method of claim 1, further including providing [[the]] IP 
addrooo and domain ^ classification based on the IP address and domain pair as input to 
a Bayesian classifier. 

30. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the IP address. 

31. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the domain. 

32. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the domain and determining that the message was forged. 

33. (original) The method of claim 1, wherein classifying includes determining a score 
for the IP address. 

34. (original) The method of claim 1, wherein classifying includes determining a score 
for the domain. 
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35. (currently amended) A computer -readable storage medium having embodied 
thereon a program, the program being executable by a processor to perform a method 
for classifying a message, comprising: 

determining [[the]] a domain from which the message is purported to be sent; 
determining an IP address from which the message was relayed at some point in 

[[its]] transmission of the message; 
associating the domain with the IP address to create an IP address and domain 

pair; [[and]] 

classifying the message baoed on the using the IP address and domain pair based 

on one or more classification variables; and 
assigning a score to the IP address and domain pair, the score comprising a ratio 

of a first classification variable to a second classification variable, the one 

or more classification variables decayed with time associated domain and 

IP addrooo . 

36. (cancelled) 
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